Examkin

Question

Difficulty: MediumLog Analytics Workspaces and KQL Queries

An administrator needs to analyze diagnostic logs for several Azure Key Vaults. The logs are collected in a Log Analytics workspace named LogsWS.

The administrator wants to retrieve the total number of operations for each Key Vault resource over the past 24 hours, grouped by the operation name.

Which Kusto Query Language (KQL) query should the administrator execute to achieve this objective?

  1. AzureDiagnostics
    | where TimeGenerated > ago(24h)
    | where ResourceProvider == "MICROSOFT.KEYVAULT"
    | summarize count() by Resource, OperationName    Answer
  2. B
    AzureDiagnostics
    | where ResourceProvider == "MICROSOFT.KEYVAULT"
    | summarize count() by Resource, OperationName
    | where TimeGenerated > ago(24h)
  3. C
    AzureDiagnostics
    | where TimeGenerated > ago(24h)
    | where ResourceProvider = "MICROSOFT.KEYVAULT"
    | group by Resource, OperationName
  4. D
    AzureDiagnostics
    | select TimeGenerated, Resource, OperationName, ResourceProvider
    | where TimeGenerated > ago(24h) and ResourceProvider == "MICROSOFT.KEYVAULT"
    | summarize count() by Resource, OperationName

Answer

The KQL query that filters by TimeGenerated and ResourceProvider before aggregating counts using the summarize operator.
The correct query evaluates the filters before summarizing the results. This represents syntactically correct KQL and respects the pipeline mechanism where columns are stripped after summarization.

Step-by-Step Solution

1
Filter the dataset by time range to reduce the amount of data processed early in the query pipeline.
Filters records to only those within the last 24 hours.
In KQL, filtering by TimeGenerated as early as possible optimizes performance.
2
Filter records by ResourceProvider to isolate Key Vault diagnostic events.
Only rows associated with the MICROSOFT.KEYVAULT provider are kept.
This ensures the query only groups operations relevant to the targeted service type.
3
Summarize the events by grouping them by Resource and OperationName, calculating the count of events for each group.
The final output projects the Resource, OperationName, and the counted events.
The summarize operator reshapes the output schema, removing all unreferenced columns such as TimeGenerated from the pipeline.

Key Concept

Kusto Query Language pipeline execution flow and schema transformation behavior.
Rate this question

Topics

Log Analytics Workspaces and KQL Queries

More questions from this topic